[github-actions]

🤖 I have created a release beep boop

0.5.0 (2026-10-23)

Features

• windows: select stable release plan after qualified RC (#179) (2893745)

---

This PR was generated with Release Please. See documentation.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T10:23:11.408324Z	d891b8d	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-23T10:23:52.089170Z	d891b8d	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

🤖 Created releases:

• windows-v0.5.0

🌻

[abruption]

Windows 0.5.0 released

The maintainer-approved Windows 10 diagnostic release path is complete: additional designated-host qualification → public RC → independently rebuilt and remeasured stable files → public stable release.

• Stable: https://github.com/abruption/codex-unlock/releases/tag/windows-v0.5.0
• Published 2026-10-23T10:39:09Z; release ID 421712266; draft=false, prerelease=false, immutable=true.
• Public tag resolves to 73eacae7f5204d3825cf0284e51a80e0940866d4.
• Final main CI: https://github.com/abruption/codex-unlock/actions/runs/39939358454 — success. CodeQL, Windows Rust, Rust experiment and fixture compilation also passed on that source.
• Build/draft/attachment: https://github.com/abruption/codex-unlock/actions/runs/39939365707 — all jobs succeeded.

Published bytes and actual host checks

Item	SHA-256
Stable ZIP	b61fdb66d0226541ec91f4d7d4afdcc9b6be9707e0e5348d93c7b92ac607c3fd
Stable executable	1b9e7454780f9bb146dc43cce164bef5814434ce11ef04d4eb0421080bb5327c
Outer manifest	c5c86a605fd636a95c2444dc60604d3aed49cf7467212899cec27004ddca2b08
Matching-source fixture	39c08fe8b3a66b4c48582390d063267604a0833e14e27099860ababa3fc6fc53
Fixture artifact 12495391227 archive	048829da04f7e6c3df3fc231d3ab6598040f2b8eaa46d394359e523ac2f14abb

The ZIP contains exactly the executable, guide, inner manifest and checksums. Server asset digests, outer/inner manifests, source, version and payload checksums matched. Anonymous public release access and ZIP download succeeded and reproduced the tested ZIP hash.

The final executable was separately tested on quintet-desktop, Windows 10 build19045/AMD64/NTFS:

• Actual High: both refusal cases passed, with native diagnostics unavailable.
• Actual Medium: all 12 cases passed; real synthetic held→free, busy coordinator, missing guard/thread, hardlinks, junction, PID observation boundaries and Unicode paths. Both native identity/metadata pairs matched; all four fixture processes exited normally through EOF and removed their own roots.
• Pinned native Codex 0.163.0: held/0, then own-server normal EOF exit 0 with no signal and zero provider connections; after exit the thread file was absent, yielding unknown/open_existing_failed/2. This is not proof of native-free state or holder attribution.
• Kaspersky File Threat Protection was enabled before/after. The local FM export explicitly had no exclusions, and the maintainer's current global UI review confirmed no applicable test path/process exclusions. Defender remained disabled; no Defender-on or Windows 11 coverage is claimed. This records configuration, not every individual antivirus scan.
• The stable output was observed as schema=codex-unlock-windows, schemaVersion=1, releaseChannel=stable, preview=false, experimental=false, safeToUnlock=false, recoveryAvailable=false.
• Root reparsed raw payloads and independently checked case outcomes, identities, cleanup and hashes. All three task names used for alpha/RC/stable Medium measurements were confirmed removed. Raw account/path/PID evidence stays private.

Private stable result digests:

• High matrix: 4f87eedc3d5902e880db360a2c407e98b69537599e45250fb7302dee930cdf82
• Medium matrix: 7b1f85340159d2a31f4e2965c64dac7ac149d0afbc4842a7e2959722dfc13f2d
• Native observation: 7012bfa2edf9f75c821f84758f6182dc7a95b0c2cf280db7b9a323daab2126e6

Review and scope accounting

Merged only the Windows preparation/promotion path:

• feat(windows)!: prepare diagnostic RC and stable qualification #177: 1bb8746d4ce80cd9c3915b7b617b6b8a289b8d45
• RC version chore(main): release windows 0.5.0-rc.1 #178: 9ea3c78fe513ea5f473f9297ac6b3229159601ba
• Stable plan feat(windows): select stable release plan after qualified RC #179: 2893745bda171abc92b164127af87d4166d55acc
• Stable version chore(main): release windows 0.5.0 #180: 73eacae7f5204d3825cf0284e51a80e0940866d4

Every PR passed 41 checks and current-head Code/Security reviews before merge. The initial #177 Node 22.13 buffer-diff OOM was fixed with exact byte comparison and bounded diagnostics. #180 had one existing macOS lease-wait timeout; the failed job passed on rerun, with the original failure preserved in Actions. No check was bypassed.

The implementation had independent non-interactive Claude Code 2.1.308 (claude-opus-5-5, response model verified) and Codex CLI 0.164.0 (isolated default, actual model not exposed) source review on input 0d89f59bc1bed17324b74434218ce09335ae4389a9ab6f08f2dd31b854786464. Both completed without tool/test execution; corrections and actual host evidence were separately verified. Unit/model review was not substituted for actual RC or stable measurement.

Homebrew #42 is Long-Term; #119/#121 are Post-0.5.0. Four README locales and platform/preview/release guides define the Windows 10 diagnostic-only scope. Wider recovery/holder research remains separate. The Windows release used make_latest=false; GitHub Latest remains v0.4.7 and npm latest remains 0.4.7. The separate npm proposal #167 remains Draft and was not published.